hinder innovation for peaceful purposes and the economic development of States in a fair and non-discriminatory environment. States also stressed the interlinkages between norms, confidence-building and capacity-building, and underscored the need for gender perspectives to be mainstreamed into norm implementation. 25. During discussions, proposals were made for the further elaboration of existing norms. States reiterated the equal importance of the protection of all critical infrastructure supporting essential services to the public which should include medical and healthcare facilities. They also drew attention to the importance of cooperating to protect critical infrastructure that provides services across borders or jurisdictions, given the potential impact of any damage to such infrastructure, as well as the importance of ensuring the general availability and integrity of the Internet. States recalled General Assembly resolution 64/211 entitled “Creation of a global culture of cybersecurity and the protection of critical information infrastructures”. 3 In addition, States also proposed further ensuring the integrity of the ICT supply chain, expressing concern over the creation of harmful hidden functions in ICT products, and the responsibility to notify users when significant vulnerabilities are identified. States furthermore expressed concern regarding the stockpiling of vulnerabilities. Some States proposed to formulate objective international rules and standards on supply chain security. 2 A/RES/73/27, operational paragraph 1. Annexed to this resolution is a Voluntary self-assessment tool for national efforts to protect critical information infrastructures. 3 26. Further to the above paragraph, written proposals made by States at the OEWG on the elaboration of existing norms, guidance on implementation as well as new norms are annexed to this summary. 27. Some States also noted the proposal for an international code of conduct for information security tabled in 2015.4 28. Some States recognized the need to encourage and support further regional efforts as well as partnerships with other stakeholders such as the private sector and the technical community on the implementation of norms. Such partnerships could be built, for example, to ensure sustainable capacity-building efforts to address differences in implementation capacities. In this regard, States recalled operational paragraph 1.13 of General Assembly resolution 73/27, which, inter alia, highlights that “States should encourage the private sector and civil society to play an appropriate role to improve security of and in the use of ICTs, including supply chain security for ICT products and services”. States noted the importance of outreach and cooperative steps to ensure that various stakeholders, including the public and private sectors and civil society, uphold their responsibilities in the use of ICTs. Confidence-building Measures 29. In their discussions at the OEWG, States noted the continuing relevance of the CBMs recommended in the consensus GGE reports. Several measures were highlighted as requiring priority attention, such as regular dialogue and voluntary information exchanges on existing and emerging threats, national policy, legislative frameworks or doctrine, national views on how international law applies to State use of ICTs, and national approaches to defining critical infrastructure and categorizing ICT-related incidents. It was suggested that sharing of good practices in approaches to digital forensics and investigation of malicious cyber incidents could both increase cooperation and build capacity. The value of developing shared 6